CVE-2026-83621
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In ntopng prior to 6.7.260717, the POST /lua/rest/v2/edit/system/edit_blacklist.lua endpoint lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates.
Risk Assessment
A low-privilege authenticated user can undermine threat-intelligence monitoring, disable blocklists, or cause malicious content to be downloaded, compromising the integrity and availability of network monitoring.
Recommendation
Update ntopng to version 6.7.260717 or later. Until patched, restrict access to system edit endpoints to administrators only.
Other vulnerabilities in ntopng
See all- CVE-2017-7458High
The NetworkInterface::getHost function in ntopng before version 3.0 allows remote attackers to cause an application crash via a NULL pointer dereference when a field that should contain a hostname or IP address is empty.
- CVE-2017-7459High
Ntopng versions before 3.0 allow HTTP Response Splitting.
- CVE-2017-5473High
CSRF vulnerability in ntopng version 2.4 allows remote attackers to hijack the authentication of arbitrary users. Examples of exploitation include admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
- CVE-2026-38968Critical
A vulnerability in ntopng up to version 6.6 allows predictable session identifiers, leading to session hijacking. HTTP session IDs are generated using weak time-seeded pseudo-randomness, making them deterministic or collision-prone.
- CVE-2026-84990High
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
- CVE-2026-82412High
In ntopng prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. The parameter is then concatenated into an nmap command and executed through ntop.execCmd or ntop.execCmdAsync and popen.
- CVE-2026-86091High
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions.
- CVE-2026-86090High
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- CVE-2026-84989High
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.
Original NVD description (English source)
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS